{ "data": { "similar": [ { "grade": "C", "json": "https://www.anchorterminal.com/tools/zus-health.json", "name": "Zus Health", "score": 56.6, "shared": [ "health.records", "health.fhir", "health.ehr", "health.consent" ], "slug": "zus-health" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/medblocks.json", "name": "Medblocks", "score": 52.7, "shared": [ "health.records", "health.consent", "health.ehr", "health.fhir" ], "slug": "medblocks" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/aidbox.json", "name": "Aidbox", "score": 64.2, "shared": [ "health.fhir", "health.records", "health.consent" ], "slug": "aidbox" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/health-gorilla.json", "name": "Health Gorilla", "score": 59.3, "shared": [ "health.records", "health.fhir", "health.consent" ], "slug": "health-gorilla" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/redox.json", "name": "Redox", "score": 58.3, "shared": [ "health.ehr", "health.fhir", "health.records" ], "slug": "redox" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/1uphealth.json", "name": "1upHealth", "score": 46.8, "shared": [ "health.records", "health.fhir", "health.consent" ], "slug": "1uphealth" } ], "tool": { "slug": "metriport", "name": "Metriport Medical API", "vendor": "Metriport Inc.", "vendorUrl": "https://www.metriport.com", "kind": "http-api", "category": "health-data", "summary": "Metriport's Medical API retrieves a patient's records from US health information exchanges, pharmacies and labs, converts them to deduplicated FHIR, and returns them through a REST API with webhooks. Production use requires a covered entity with an NPI.", "url": "https://www.anchorterminal.com/tools/metriport", "markdownUrl": "https://www.anchorterminal.com/tools/metriport.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/metriport.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/metriport.json", "repo": "https://github.com/metriport/metriport", "license": "Proprietary hosted service under Metriport's terms of use. The source in metriport/metriport is AGPLv3, with an enterprise directory under its own licence, and the @metriport/api-sdk package on npm is MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@metriport/api-sdk" } ], "auth": "api-key", "authNotes": "Every request sends a key in the `x-api-key` header to https://api.metriport.com, or https://api.sandbox.metriport.com in sandbox mode. Keys are generated in the developer dashboard after Metriport approves the account, up to two at once for rotation, each revocable at once and each with full access including destructive operations. No scopes or read-only key were found. Production access needs a covered entity with an NPI and a treatment purpose of use, agreed on an intro call.", "pricing": "paid", "pricingNotes": "No public prices. metriport.com has no pricing page, the terms say some services carry a fee paid by card, wire or Stripe, and production access starts with an intro call booked from the dashboard. A sandbox with example patients opens once Metriport approves the access request, and its cost is not stated (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation, llms.txt, the repository README or the terms (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 793, "npmWeekly": 28168, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.metriport.com/medical-api/getting-started/quickstart", "llmsTxt": "https://docs.metriport.com/llms.txt", "capabilities": [ "health.records", "health.fhir", "health.consent", "health.ehr" ], "tags": [ "hosted", "health-records", "fhir", "open-source", "agpl", "typescript", "llms-txt", "webhooks", "status-page", "sales-led", "hitrust", "soc2" ], "lastRelease": "2026-09-28", "graded": true, "anchor": { "graded": true, "score": 50.1, "grade": "D", "agentReady": false, "rank": 833, "ranked": true, "rankOf": 1076, "categoryRank": 10, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 74, "payments": 5, "reliability": 45, "schema": 65, "security": 41, "transparency": 56 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 45, "points": 9, "reason": "Read with the hosted lines. status.metriport.com is a Checkly dashboard that renders only with JavaScript, so we confirmed the page exists but could not read components or history (10 of 20, history unreadable 5). Rate limits are published per operation, such as 15 patient creates and 20 network queries a minute (15). No 429, Retry-After or backoff guidance was found. ETag with `If-Match` and a 412 on stale updates gives safe concurrent writes (5 of 15). No SLA was found, and the terms say the site cannot be guaranteed available (0). The Medical API is generally available, with legacy document query endpoints marked as such (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 65, "points": 10.56, "reason": "The public repository holds a Fern API definition that the docs call the OpenAPI specification. It covers patients, facilities, FHIR, documents and webhooks, but not network query, cohorts, messages or settings, and the repository was last synced on 27 August 2026 (12 of 25). llms.txt and a Markdown copy of every page (10). Descriptions state when to use an endpoint and its traps, such as the consolidated query returning cached data and network query returning 2XX with partial failures (16 of 20). Parameters are typed with defaults in hand-written reference pages, without a schema file for most of them (10 of 15). SDK examples on each page and an RFC 7807 error format (12 of 15). Paths are versioned under /medical/v1, but no public changelog was found (5 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 70, "points": 11.38, "reason": "Lists take `count` up to 500, consolidated queries filter by resource type and date, a count endpoint sizes a patient's record before fetching, and summaries cut the volume (18 of 25). Cursor-style pagination with `nextPage` URLs and filters (18 of 20). Errors carry a stable `title` and an occurrence `detail` (16 of 20). No idempotency keys. ETag guards updates, and failed webhooks can be listed and retried (10 of 20). Few required fields, but the only official SDK is TypeScript (8 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 41, "points": 7.18, "reason": "One kind of key, sent in the `x-api-key` header, with full access including destructive operations. Two keys can be active for rotation and each is revocable at once (15 of 30). No read-only key or scopes for the API. Dashboard roles separate clinical, billing and developer access, and patients can be opted out of HIE exchange (5 of 20). The API returns external C-CDA, PDF and image documents with no prompt-injection guidance (3 of 15). Webhook requests can be listed, and no API audit log was found (4 of 15). HITRUST r2 and SOC 2 Type 2 are claimed in the README, SECURITY.md routes reports through GitHub or email, with no security.txt or bug bounty (14 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 5, "points": 0.63, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). No published prices (0). A sandbox with example patients opens after Metriport approves the account, with no price or card requirement stated (5 of 20). A person signs up in the dashboard and waits for approval, and production starts with an intro call (0). The AGPLv3 source can be self-hosted, but it needs the operator's own network memberships, so the hosted API is what we graded." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 74, "points": 6.48, "reason": "@metriport/api-sdk 18.22.0 was published on 28 September 2026 (30). Seven SDK releases since 16 July 2026 (20). No public changelog. Support is by email, and the public repository has 74 open issues that we could not read because GitHub's API rate-limited us (7 of 25). One current official SDK, in TypeScript (10 of 15). The repository has CI workflows for build, deploy and end-to-end tests (7 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 56, "points": 4.9, "note": "editorial 43, provenance 69", "reason": "The source is AGPLv3, with an enterprise directory under a separate licence, while the hosted service runs under terms of use from January 2024. The public mirror lags the private repository (25 of 30). The privacy policy (February 2023) covers the website and contacts only, and no DPA, BAA or retention period for API data was found in public (8 of 30). Legacy endpoints are labelled, with no dated deprecation policy (5 of 20). Data stays in the US per the privacy policy, with no sub-processor list (5 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Lists take `count` up to 500, consolidated queries filter by resource type and date, a count endpoint sizes a patient's record before fetching, and summaries cut the volume (18 of 25). Cursor-style pagination with `nextPage` URLs and filters (18 of 20). Errors carry a stable `title` and an occurrence `detail` (16 of 20). No idempotency keys. ETag guards updates, and failed webhooks can be listed and retried (10 of 20). Few required fields, but the only official SDK is TypeScript (8 of 15).", "maintenance": "@metriport/api-sdk 18.22.0 was published on 28 September 2026 (30). Seven SDK releases since 16 July 2026 (20). No public changelog. Support is by email, and the public repository has 74 open issues that we could not read because GitHub's API rate-limited us (7 of 25). One current official SDK, in TypeScript (10 of 15). The repository has CI workflows for build, deploy and end-to-end tests (7 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). No published prices (0). A sandbox with example patients opens after Metriport approves the account, with no price or card requirement stated (5 of 20). A person signs up in the dashboard and waits for approval, and production starts with an intro call (0). The AGPLv3 source can be self-hosted, but it needs the operator's own network memberships, so the hosted API is what we graded.", "reliability": "Read with the hosted lines. status.metriport.com is a Checkly dashboard that renders only with JavaScript, so we confirmed the page exists but could not read components or history (10 of 20, history unreadable 5). Rate limits are published per operation, such as 15 patient creates and 20 network queries a minute (15). No 429, Retry-After or backoff guidance was found. ETag with `If-Match` and a 412 on stale updates gives safe concurrent writes (5 of 15). No SLA was found, and the terms say the site cannot be guaranteed available (0). The Medical API is generally available, with legacy document query endpoints marked as such (10).", "schema": "The public repository holds a Fern API definition that the docs call the OpenAPI specification. It covers patients, facilities, FHIR, documents and webhooks, but not network query, cohorts, messages or settings, and the repository was last synced on 27 August 2026 (12 of 25). llms.txt and a Markdown copy of every page (10). Descriptions state when to use an endpoint and its traps, such as the consolidated query returning cached data and network query returning 2XX with partial failures (16 of 20). Parameters are typed with defaults in hand-written reference pages, without a schema file for most of them (10 of 15). SDK examples on each page and an RFC 7807 error format (12 of 15). Paths are versioned under /medical/v1, but no public changelog was found (5 of 15).", "security": "One kind of key, sent in the `x-api-key` header, with full access including destructive operations. Two keys can be active for rotation and each is revocable at once (15 of 30). No read-only key or scopes for the API. Dashboard roles separate clinical, billing and developer access, and patients can be opted out of HIE exchange (5 of 20). The API returns external C-CDA, PDF and image documents with no prompt-injection guidance (3 of 15). Webhook requests can be listed, and no API audit log was found (4 of 15). HITRUST r2 and SOC 2 Type 2 are claimed in the README, SECURITY.md routes reports through GitHub or email, with no security.txt or bug bounty (14 of 20).", "transparency": "The source is AGPLv3, with an enterprise directory under a separate licence, while the hosted service runs under terms of use from January 2024. The public mirror lags the private repository (25 of 30). The privacy policy (February 2023) covers the website and contacts only, and no DPA, BAA or retention period for API data was found in public (8 of 30). Legacy endpoints are labelled, with no dated deprecation policy (5 of 20). Data stays in the US per the privacy policy, with no sub-processor list (5 of 20)." }, "sources": [ { "what": "documentation index", "url": "https://docs.metriport.com/llms.txt", "seen": "2026-10-14" }, { "what": "quickstart", "url": "https://docs.metriport.com/medical-api/getting-started/quickstart.md", "seen": "2026-10-14" }, { "what": "API keys", "url": "https://docs.metriport.com/medical-api/getting-started/api-keys.md", "seen": "2026-10-14" }, { "what": "sandbox", "url": "https://docs.metriport.com/medical-api/getting-started/sandbox.md", "seen": "2026-10-14" }, { "what": "rate limits", "url": "https://docs.metriport.com/medical-api/more-info/limits.md", "seen": "2026-10-14" }, { "what": "error responses", "url": "https://docs.metriport.com/medical-api/more-info/error-responses.md", "seen": "2026-10-14" }, { "what": "start network query", "url": "https://docs.metriport.com/medical-api/api-reference/network/start-network-query.md", "seen": "2026-10-14" }, { "what": "repository, licence and Fern definition", "url": "https://github.com/metriport/metriport", "seen": "2026-10-14" }, { "what": "SDK on npm", "url": "https://registry.npmjs.org/@metriport/api-sdk", "seen": "2026-10-14" }, { "what": "terms of use", "url": "https://www.metriport.com/terms", "seen": "2026-10-14" }, { "what": "privacy policy", "url": "https://www.metriport.com/privacy-policy", "seen": "2026-10-14" }, { "what": "status page", "url": "https://status.metriport.com", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: status page history, because status.metriport.com renders only with JavaScript", "unchecked: the trust centre at security.metriport.com, which renders only with JavaScript", "unchecked: GitHub issue response times, because the GitHub API rate-limited us", "Whether the sandbox is free, and how long approval takes, is not stated" ] }, "negative": 0, "verdict": "One network query pulls a patient's records from HIEs, pharmacies and labs and returns deduplicated FHIR, with per-operation rate limits, RFC 7807 errors and AGPLv3 source. Each API key has full access with no scopes, there are no public prices, and the sandbox opens only after Metriport approves the account.", "bestFor": "US care providers and digital health companies that need a patient's network records as FHIR with webhooks.", "strengths": [ "One asynchronous network query covers HIEs, pharmacies and labs, with a webhook as each source is merged", "Consolidated FHIR output is deduplicated and coded, with PDF or HTML record summaries", "Rate limits published per operation, and `count` up to 500 per page", "AGPLv3 source on GitHub and an MIT TypeScript SDK released on 28 September 2026" ], "weaknesses": [ "Every API key has full access, including destructive operations, with no scopes", "No public prices, and the sandbox needs Metriport's approval first", "The Fern definition covers only part of the API and no public changelog was found", "The status page renders only with JavaScript, so its history could not be read" ], "agentNotes": [ "Check the `errors` array after Start Network Query. It returns 2XX even when some sources fail", "Wait for `network-query.*` webhooks or poll Get Network Query Status before reading consolidated data, which is cached from the last query", "Send the resource's `eTag` in `If-Match` on updates to avoid overwriting newer data", "Keep patient creates under 15 a minute and network queries under 20 a minute per source", "In sandbox, create patients whose first name matches a pre-defined persona to get example records" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 50.1 } ], "editorialScores": { "ergonomics": 70, "maintenance": 74, "payments": 5, "reliability": 45, "schema": 65, "security": 41, "transparency": 43 }, "provenanceScore": 69 }, "connect": { "install": "npm install --save @metriport/api-sdk", "http": "POST https://api.sandbox.metriport.com/medical/v1/patient?facilityId=\u003cfacility-id\u003e\nx-api-key: \u003capi-key\u003e\nContent-Type: application/json" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/metriport" }, "notable": [ "A network query runs asynchronously across HIEs, pharmacies and labs, and emits `network-query.hie`, `network-query.pharmacy` and `network-query.lab` webhooks as each source is merged (https://docs.metriport.com/medical-api/api-reference/network/start-network-query.md)", "Start Network Query returns 2XX even when some sources fail, with failures listed in an `errors` array (https://docs.metriport.com/medical-api/api-reference/network/start-network-query.md)", "Individual Access Services let a verified patient pull their own records, with an AAL2 session header required when `purposeOfUse` is `ias` (https://docs.metriport.com/medical-api/getting-started/ias.md)", "Customers must contribute net-new clinical data back to the networks, through FHIR bundles or document uploads (https://docs.metriport.com/medical-api/getting-started/quickstart.md)", "The public repository is synced from a private one. Its history shows commits on 28 to 30 October 2025 and then a sync on 27 August 2026 (https://github.com/metriport/metriport)", "The README claims HITRUST r2, SOC 2 Type 2 and HIPAA compliance and links a trust centre at security.metriport.com, which renders only with JavaScript (https://github.com/metriport/metriport)" ], "area": "domain-data", "details": [ { "label": "Endpoints", "value": "Production https://api.metriport.com, sandbox https://api.sandbox.metriport.com, all under /medical/v1" }, { "label": "Data sources", "value": "HIE networks, pharmacies and labs through one network query, plus ADT notifications and EHR apps for athenahealth, Canvas, Elation, Healthie, Salesforce, Epic, Practice Fusion and eClinicalWorks" }, { "label": "Data out", "value": "Consolidated FHIR bundles (deduplicated, coded), C-CDA and PDF source documents, a Medical Record Summary in PDF or HTML, AI summaries, care gaps and suspected conditions" }, { "label": "Rate limits", "value": "Patient create or update 15 a minute, network query 20 a minute per source, consolidated query and create 120 a minute, send message 20 a minute" }, { "label": "Pagination", "value": "`count` up to 500 (default 50), `fromItem` and `toItem`, with `meta.nextPage` URLs" }, { "label": "Errors", "value": "RFC 7807 style bodies with `status`, `name`, `title` (stable) and `detail`" }, { "label": "Writes", "value": "ETag on resources, sent back with `If-Match`, and 412 on a stale update" }, { "label": "Sandbox", "value": "Pre-defined personas matched by first name, about six example documents each (C-CDA, FHIR, PDFs, images), test NPI 1234567893" }, { "label": "SDK", "value": "@metriport/api-sdk 18.22.0 (28 September 2026), TypeScript only, MIT" }, { "label": "Status", "value": "status.metriport.com, a Checkly dashboard that renders only with JavaScript" } ], "provenance": { "legalEntity": "Metriport Inc.", "domain": "metriport.com", "domainRegistered": "2021-02-09", "endpointOnVendorDomain": true, "terms": "https://www.metriport.com/terms", "privacy": "https://www.metriport.com/privacy-policy", "statusPage": "https://status.metriport.com", "changelog": "", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The terms of use (last updated January 2024) give a registered office at 2261 Market Street #4818, San Francisco, CA 94114, forbid access 'through automated or non-human means' and the use of 'data mining, robots, or similar data gathering and extraction tools', and say the site is not built for HIPAA-regulated use. We read them as a fact and fetched only what robots.txt allows.", "The privacy policy (last updated 21 February 2023) covers website visitors and customer contacts, says data is stored in the US, and does not mention API data or PHI.", "www.metriport.com/.well-known/security.txt returns 404. SECURITY.md in the repository sends reports to GitHub's vulnerability reporting or support@metriport.com.", "No public changelog was found in the documentation or on the website.", "RDAP gives metriport.com a registration date of 2021-02-09." ], "score": 69, "checks": [ { "check": "Legal entity named", "value": "Metriport Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "metriport.com, registered 2021-02-09 (5 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "metriport.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 3 clauses that cost points", "points": 3.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.metriport.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://www.metriport.com/terms", "state": "read", "readAt": "2026-10-14", "statedDate": "2024-01-01", "words": 5127, "points": 3.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated January 2024", "says": "Last updated 2024-01-01" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "and yourself irrevocably consent that the courts of the United States shall have exclusive jurisdiction to resolve any dispute which may arise in connection with these terms.", "says": "Disputes go to the courts of the United States" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "IN NO EVENT WILL WE OR OUR DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFIT, LOST REVENUE, LOSS OF DATA, OR OTHER DAMAGES ARISING FROM YOUR USE OF THE SITE, EVEN IF WE HAVE BEEN ADVISE…", "says": "Rules out indirect and consequential losses, with no cap named in this sentence" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "If you provide any information that is untrue, inaccurate, not current, or incomplete, we have the right to suspend or terminate your account and refuse any and all current or future use of the Site (or any portion thereof)." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "We will alert you about any changes by updating the “Last updated” date of these Terms of Use, and you waive any right to receive specific notice of each such change.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "The Site is not tailored to comply with industry-specific regulations (Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Management Act (FISMA), etc.), so if your interactions would be subjected to such laws, you may not use this Site." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "(3) you will not access the Site through automated or non-human means, whether through a bot, script or otherwise;", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "Use the Site as part of any effort to compete with us or otherwise use the Site and/or the Content for any revenue-generating endeavor or commercial enterprise.", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "We will alert you about any changes by updating the “Last updated” date of these Terms of Use, and you waive any right to receive specific notice of each such change.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "WE MAY TERMINATE YOUR USE OR PARTICIPATION IN THE SITE OR DELETE ANY CONTENT OR INFORMATION THAT YOU POSTED AT ANY TIME, WITHOUT WARNING, IN OUR SOLE DISCRETION." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "Binding Arbitration If the Parties are unable to resolve a Dispute through informal negotiations, the Dispute (except those Disputes expressly excluded below) will be finally and exclusively resolved by binding arbitration." } ], "notes": [ { "date": "2026-10-14", "text": "The terms say the Site is not built to comply with HIPAA or FISMA and must not be used where those laws apply.", "quote": "The Site is not tailored to comply with industry-specific regulations (Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Management Act (FISMA), etc.), so if your interactions would be subjected to such laws, you may not use this Site." }, { "date": "2026-10-14", "text": "Using a buying agent or purchasing agent to make purchases is prohibited.", "quote": "Use a buying agent or purchasing agent to make purchases on the Site." }, { "date": "2026-10-14", "text": "Metriport excludes liability for all damages arising from use of the Site, direct damages included.", "quote": "IN NO EVENT WILL WE OR OUR DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFIT, LOST REVENUE, LOSS OF DATA, OR OTHER DAMAGES ARISING FROM YOUR USE OF THE SITE" } ] }, { "kind": "privacy", "url": "https://www.metriport.com/privacy-policy", "state": "read", "readAt": "2026-10-14", "statedDate": "2023-02-21", "words": 1955, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated February 21st 2023", "says": "Last updated 2023-02-21" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "• How we collect and use (process) your personal information" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Persistent cookies last until you or your browser delete them or until they expire." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "• When and how we share information with third parties" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We do not sell personal information to anyone and only share it with third parties who are facilitating the delivery of our services.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "You have a right to correct (rectify) the record of your personal data maintained by Metriport if it is inaccurate." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Metriport has appointed an internal data protection officer for you to contact if you have any questions or concerns about Metriport’s personal data policies or practices.", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Information we collect about you will be processed in the United States.", "says": "Data goes to the United States" } ], "toKnow": [ { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Last updated February 21st 2023" } ], "notes": [ { "date": "2026-10-14", "text": "Metriport keeps service data after the customer relationship ends, to analyse it for its own operations and for archiving.", "quote": "The Metriport retains service data for the duration of the customer’s business relationship with the Metriport and for a period of time thereafter, to analyze the data for Metriport’s own operations, and for historical and archiving purposes associated with Metriport’s services." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/metriport.json", "live": { "slug": "metriport", "vendorStatus": { "page": "https://status.metriport.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:23.949542071Z" }, "updatedAt": "2026-10-14T08:53:23.949542071Z" } }, "verify": { "accepts": "a page on metriport.com or one of its subdomains, or the README of github.com/metriport/metriport", "badgeUrl": "https://www.anchorterminal.com/badges/metriport.svg", "body": { "slug": "metriport", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/metriport", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/metriport\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/metriport.svg\" alt=\"Metriport Medical API on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Metriport Medical API on Anchor Terminal](https://www.anchorterminal.com/badges/metriport.svg)](https://www.anchorterminal.com/tools/metriport)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/metriport\"\u003eMetriport Medical API on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/metriport", "json": "https://www.anchorterminal.com/tools/metriport.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/metriport.md", "slim": "https://www.anchorterminal.com/tools/metriport.min.md" }, "markdown": "## Overview\n\n**Grade D · 50.1/100 · rank #833 of 1076 · #10 in Health records \u0026 wellness data · not agent-ready · confidence medium**\n\n\n## Assessment\n\nOne network query pulls a patient's records from HIEs, pharmacies and labs and returns deduplicated FHIR, with per-operation rate limits, RFC 7807 errors and AGPLv3 source. Each API key has full access with no scopes, there are no public prices, and the sandbox opens only after Metriport approves the account.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Metriport Inc. (https://www.metriport.com) |\n| Kind | HTTP API |\n| Category | Health records \u0026 wellness data (https://www.anchorterminal.com/categories/health-data) |\n| Transport | HTTP |\n| Auth | API key · Every request sends a key in the `x-api-key` header to https://api.metriport.com, or https://api.sandbox.metriport.com in sandbox mode. Keys are generated in the developer dashboard after Metriport approves the account, up to two at once for rotation, each revocable at once and each with full access including destructive operations. No scopes or read-only key were found. Production access needs a covered entity with an NPI and a treatment purpose of use, agreed on an intro call. |\n| Pricing | Paid (Paid) · No public prices. metriport.com has no pricing page, the terms say some services carry a fee paid by card, wire or Stripe, and production access starts with an intro call booked from the dashboard. A sandbox with example patients opens once Metriport approves the access request, and its cost is not stated (checked 2026-10-14). |\n| x402 | No · No x402, MPP or L402 in the documentation, llms.txt, the repository README or the terms (checked 2026-10-14). |\n| Licence | Proprietary hosted service under Metriport's terms of use. The source in metriport/metriport is AGPLv3, with an enterprise directory under its own licence, and the @metriport/api-sdk package on npm is MIT |\n| Packages | npm: `@metriport/api-sdk` |\n| Source | https://github.com/metriport/metriport |\n| Docs | https://docs.metriport.com/medical-api/getting-started/quickstart |\n| llms.txt | https://docs.metriport.com/llms.txt |\n| Last release | 2026-09-28 |\n| GitHub stars | 793 (as of 2026-10-14) |\n| npm downloads / week | 28,168 |\n| Endpoints | Production https://api.metriport.com, sandbox https://api.sandbox.metriport.com, all under /medical/v1 |\n| Data sources | HIE networks, pharmacies and labs through one network query, plus ADT notifications and EHR apps for athenahealth, Canvas, Elation, Healthie, Salesforce, Epic, Practice Fusion and eClinicalWorks |\n| Data out | Consolidated FHIR bundles (deduplicated, coded), C-CDA and PDF source documents, a Medical Record Summary in PDF or HTML, AI summaries, care gaps and suspected conditions |\n| Rate limits | Patient create or update 15 a minute, network query 20 a minute per source, consolidated query and create 120 a minute, send message 20 a minute |\n| Pagination | `count` up to 500 (default 50), `fromItem` and `toItem`, with `meta.nextPage` URLs |\n| Errors | RFC 7807 style bodies with `status`, `name`, `title` (stable) and `detail` |\n| Writes | ETag on resources, sent back with `If-Match`, and 412 on a stale update |\n| Sandbox | Pre-defined personas matched by first name, about six example documents each (C-CDA, FHIR, PDFs, images), test NPI 1234567893 |\n| SDK | @metriport/api-sdk 18.22.0 (28 September 2026), TypeScript only, MIT |\n| Status | status.metriport.com, a Checkly dashboard that renders only with JavaScript |\n| Capabilities | health.records, health.fhir, health.consent, health.ehr |\n| Tags | hosted, health-records, fhir, open-source, agpl, typescript, llms-txt, webhooks, status-page, sales-led, hitrust, soc2 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/metriport.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 45 | 9.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 65 | 10.6 |\n| Agent ergonomics | 13% | 16.2 | 70 | 11.4 |\n| Security \u0026 auth | 14% | 17.5 | 41 | 7.2 |\n| Payments \u0026 pricing | 10% | 12.5 | 5 | 0.6 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 74 | 6.5 |\n| Transparency \u0026 trust (editorial 43, provenance 69) | 7% | 8.8 | 56 | 4.9 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **50.1 → D** |\n\n### Why each score\n\n- Reliability 45: Read with the hosted lines. status.metriport.com is a Checkly dashboard that renders only with JavaScript, so we confirmed the page exists but could not read components or history (10 of 20, history unreadable 5). Rate limits are published per operation, such as 15 patient creates and 20 network queries a minute (15). No 429, Retry-After or backoff guidance was found. ETag with `If-Match` and a 412 on stale updates gives safe concurrent writes (5 of 15). No SLA was found, and the terms say the site cannot be guaranteed available (0). The Medical API is generally available, with legacy document query endpoints marked as such (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 65: The public repository holds a Fern API definition that the docs call the OpenAPI specification. It covers patients, facilities, FHIR, documents and webhooks, but not network query, cohorts, messages or settings, and the repository was last synced on 27 August 2026 (12 of 25). llms.txt and a Markdown copy of every page (10). Descriptions state when to use an endpoint and its traps, such as the consolidated query returning cached data and network query returning 2XX with partial failures (16 of 20). Parameters are typed with defaults in hand-written reference pages, without a schema file for most of them (10 of 15). SDK examples on each page and an RFC 7807 error format (12 of 15). Paths are versioned under /medical/v1, but no public changelog was found (5 of 15).\n- Agent ergonomics 70: Lists take `count` up to 500, consolidated queries filter by resource type and date, a count endpoint sizes a patient's record before fetching, and summaries cut the volume (18 of 25). Cursor-style pagination with `nextPage` URLs and filters (18 of 20). Errors carry a stable `title` and an occurrence `detail` (16 of 20). No idempotency keys. ETag guards updates, and failed webhooks can be listed and retried (10 of 20). Few required fields, but the only official SDK is TypeScript (8 of 15).\n- Security \u0026 auth 41: One kind of key, sent in the `x-api-key` header, with full access including destructive operations. Two keys can be active for rotation and each is revocable at once (15 of 30). No read-only key or scopes for the API. Dashboard roles separate clinical, billing and developer access, and patients can be opted out of HIE exchange (5 of 20). The API returns external C-CDA, PDF and image documents with no prompt-injection guidance (3 of 15). Webhook requests can be listed, and no API audit log was found (4 of 15). HITRUST r2 and SOC 2 Type 2 are claimed in the README, SECURITY.md routes reports through GitHub or email, with no security.txt or bug bounty (14 of 20).\n- Payments \u0026 pricing 5: Read with the hosted rubric. No x402, MPP or L402 (0). No published prices (0). A sandbox with example patients opens after Metriport approves the account, with no price or card requirement stated (5 of 20). A person signs up in the dashboard and waits for approval, and production starts with an intro call (0). The AGPLv3 source can be self-hosted, but it needs the operator's own network memberships, so the hosted API is what we graded.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 74: @metriport/api-sdk 18.22.0 was published on 28 September 2026 (30). Seven SDK releases since 16 July 2026 (20). No public changelog. Support is by email, and the public repository has 74 open issues that we could not read because GitHub's API rate-limited us (7 of 25). One current official SDK, in TypeScript (10 of 15). The repository has CI workflows for build, deploy and end-to-end tests (7 of 10).\n- Transparency \u0026 trust 56: The source is AGPLv3, with an enterprise directory under a separate licence, while the hosted service runs under terms of use from January 2024. The public mirror lags the private repository (25 of 30). The privacy policy (February 2023) covers the website and contacts only, and no DPA, BAA or retention period for API data was found in public (8 of 30). Legacy endpoints are labelled, with no dated deprecation policy (5 of 20). Data stays in the US per the privacy policy, with no sub-processor list (5 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (15 items): https://www.anchorterminal.com/fixes/metriport.md (JSON https://www.anchorterminal.com/fixes/metriport.json)\n\n### What we couldn't check\n\n- unchecked: status page history, because status.metriport.com renders only with JavaScript\n- unchecked: the trust centre at security.metriport.com, which renders only with JavaScript\n- unchecked: GitHub issue response times, because the GitHub API rate-limited us\n- Whether the sandbox is free, and how long approval takes, is not stated\n\n### Sources\n\n- documentation index: \u003chttps://docs.metriport.com/llms.txt\u003e (seen 2026-10-14)\n- quickstart: \u003chttps://docs.metriport.com/medical-api/getting-started/quickstart.md\u003e (seen 2026-10-14)\n- API keys: \u003chttps://docs.metriport.com/medical-api/getting-started/api-keys.md\u003e (seen 2026-10-14)\n- sandbox: \u003chttps://docs.metriport.com/medical-api/getting-started/sandbox.md\u003e (seen 2026-10-14)\n- rate limits: \u003chttps://docs.metriport.com/medical-api/more-info/limits.md\u003e (seen 2026-10-14)\n- error responses: \u003chttps://docs.metriport.com/medical-api/more-info/error-responses.md\u003e (seen 2026-10-14)\n- start network query: \u003chttps://docs.metriport.com/medical-api/api-reference/network/start-network-query.md\u003e (seen 2026-10-14)\n- repository, licence and Fern definition: \u003chttps://github.com/metriport/metriport\u003e (seen 2026-10-14)\n- SDK on npm: \u003chttps://registry.npmjs.org/@metriport/api-sdk\u003e (seen 2026-10-14)\n- terms of use: \u003chttps://www.metriport.com/terms\u003e (seen 2026-10-14)\n- privacy policy: \u003chttps://www.metriport.com/privacy-policy\u003e (seen 2026-10-14)\n- status page: \u003chttps://status.metriport.com\u003e (seen 2026-10-14)\n\n## Who's behind it (provenance 69/100, checked 2026-10-14)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Metriport Inc. | 20/20 |\n| Domain age | metriport.com, registered 2021-02-09 (5 years) | 11/15 |\n| Endpoint on the vendor's domain | metriport.com | 15/15 |\n| Terms of service | read, states 6 of the 7 things a reader expects, and has 3 clauses that cost points | 3.1/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | status.metriport.com | 10/10 |\n| Changelog | not found | 0/10 |\n| security.txt | not found | 0/10 |\n\nThe terms of use (last updated January 2024) give a registered office at 2261 Market Street #4818, San Francisco, CA 94114, forbid access 'through automated or non-human means' and the use of 'data mining, robots, or similar data gathering and extraction tools', and say the site is not built for HIPAA-regulated use. We read them as a fact and fetched only what robots.txt allows.\n\nThe privacy policy (last updated 21 February 2023) covers website visitors and customer contacts, says data is stored in the US, and does not mention API data or PHI.\n\nwww.metriport.com/.well-known/security.txt returns 404. SECURITY.md in the repository sends reports to GitHub's vulnerability reporting or support@metriport.com.\n\nNo public changelog was found in the documentation or on the website.\n\nRDAP gives metriport.com a registration date of 2021-02-09.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.metriport.com/terms), read 2026-10-14, dated 2024-01-01, states 6 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"(3) you will not access the Site through automated or non-human means, whether through a bot, script or otherwise;\"\n- To know. Restricts benchmarking or competitive use (costs points). \"Use the Site as part of any effort to compete with us or otherwise use the Site and/or the Content for any revenue-generating endeavor or commercial enterprise.\"\n- To know. Says the terms or the service can change without notice (costs points). \"We will alert you about any changes by updating the “Last updated” date of these Terms of Use, and you waive any right to receive specific notice of each such change.\"\n- To know. Says access can be ended without notice or for any reason. \"WE MAY TERMINATE YOUR USE OR PARTICIPATION IN THE SITE OR DELETE ANY CONTENT OR INFORMATION THAT YOU POSTED AT ANY TIME, WITHOUT WARNING, IN OUR SOLE DISCRETION.\"\n- To know. Requires arbitration or waives class actions. \"Binding Arbitration If the Parties are unable to resolve a Dispute through informal negotiations, the Dispute (except those Disputes expressly excluded below) will be finally and exclusively resolved by binding arbitration.\"\n- Gives the date it was last updated. Last updated 2024-01-01.\n- Names the governing law or courts. Disputes go to the courts of the United States.\n- States a limit on its liability. Rules out indirect and consequential losses, with no cap named in this sentence.\n- Says how changes to the terms are announced. Says it gives notice of a change.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-14). The terms say the Site is not built to comply with HIPAA or FISMA and must not be used where those laws apply. \"The Site is not tailored to comply with industry-specific regulations (Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Management Act (FISMA), etc.), so if your interactions would be subjected to such laws, you may not use this Site.\"\n- Also in the text (2026-10-14). Using a buying agent or purchasing agent to make purchases is prohibited. \"Use a buying agent or purchasing agent to make purchases on the Site.\"\n- Also in the text (2026-10-14). Metriport excludes liability for all damages arising from use of the Site, direct damages included. \"IN NO EVENT WILL WE OR OUR DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFIT, LOST REVENUE, LOSS OF DATA, OR OTHER DAMAGES ARISING FROM YOUR USE OF THE SITE\"\n\n**Privacy policy** (https://www.metriport.com/privacy-policy), read 2026-10-14, dated 2023-02-21, states 8 of the 8 things a reader expects.\n\n- To know. Has not been updated for three years or more. \"Last updated February 21st 2023\"\n- Gives the date it was last updated. Last updated 2023-02-21.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. Names a data protection officer.\n- Says where data is transferred or stored. Data goes to the United States.\n- Also in the text (2026-10-14). Metriport keeps service data after the customer relationship ends, to analyse it for its own operations and for archiving. \"The Metriport retains service data for the duration of the customer’s business relationship with the Metriport and for a period of time thereafter, to analyze the data for Metriport’s own operations, and for historical and archiving purposes associated with Metriport’s services.\"\n\n## Live (updated 2026-10-14 08:53 UTC)\n\n- Vendor status page: unknown, no machine-readable status found\n- Always current: https://www.anchorterminal.com/api/v1/live/metriport.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- One asynchronous network query covers HIEs, pharmacies and labs, with a webhook as each source is merged\n- Consolidated FHIR output is deduplicated and coded, with PDF or HTML record summaries\n- Rate limits published per operation, and `count` up to 500 per page\n- AGPLv3 source on GitHub and an MIT TypeScript SDK released on 28 September 2026\n\n## Weaknesses\n\n- Every API key has full access, including destructive operations, with no scopes\n- No public prices, and the sandbox needs Metriport's approval first\n- The Fern definition covers only part of the API and no public changelog was found\n- The status page renders only with JavaScript, so its history could not be read\n\n## Before you call it (notes for agents)\n\n1. Check the `errors` array after Start Network Query. It returns 2XX even when some sources fail\n2. Wait for `network-query.*` webhooks or poll Get Network Query Status before reading consolidated data, which is cached from the last query\n3. Send the resource's `eTag` in `If-Match` on updates to avoid overwriting newer data\n4. Keep patient creates under 15 a minute and network queries under 20 a minute per source\n5. In sandbox, create patients whose first name matches a pre-defined persona to get example records\n\n## Connect\n\nInstall:\n\n```bash\nnpm install --save @metriport/api-sdk\n```\n\nFirst request:\n\n```bash\nPOST https://api.sandbox.metriport.com/medical/v1/patient?facilityId=\u003cfacility-id\u003e\nx-api-key: \u003capi-key\u003e\nContent-Type: application/json\n```\n\nThrough letme (picks today, calling later): https://letme.dev/metriport. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Zus Health | C | 56.6 | 669 | health.records, health.fhir, health.ehr, health.consent | no | https://www.anchorterminal.com/tools/zus-health.md |\n| Medblocks | D | 52.7 | 773 | health.records, health.consent, health.ehr, health.fhir | no | https://www.anchorterminal.com/tools/medblocks.md |\n| Aidbox | B | 64.2 | 385 | health.fhir, health.records, health.consent | no | https://www.anchorterminal.com/tools/aidbox.md |\n| Health Gorilla | C | 59.3 | 583 | health.records, health.fhir, health.consent | no | https://www.anchorterminal.com/tools/health-gorilla.md |\n| Redox | C | 58.3 | 618 | health.ehr, health.fhir, health.records | no | https://www.anchorterminal.com/tools/redox.md |\n| 1upHealth | D | 46.8 | 903 | health.records, health.fhir, health.consent | no | https://www.anchorterminal.com/tools/1uphealth.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- A network query runs asynchronously across HIEs, pharmacies and labs, and emits `network-query.hie`, `network-query.pharmacy` and `network-query.lab` webhooks as each source is merged (source: \u003chttps://docs.metriport.com/medical-api/api-reference/network/start-network-query.md\u003e)\n- Start Network Query returns 2XX even when some sources fail, with failures listed in an `errors` array (source: \u003chttps://docs.metriport.com/medical-api/api-reference/network/start-network-query.md\u003e)\n- Individual Access Services let a verified patient pull their own records, with an AAL2 session header required when `purposeOfUse` is `ias` (source: \u003chttps://docs.metriport.com/medical-api/getting-started/ias.md\u003e)\n- Customers must contribute net-new clinical data back to the networks, through FHIR bundles or document uploads (source: \u003chttps://docs.metriport.com/medical-api/getting-started/quickstart.md\u003e)\n- The public repository is synced from a private one. Its history shows commits on 28 to 30 October 2025 and then a sync on 27 August 2026 (source: \u003chttps://github.com/metriport/metriport\u003e)\n- The README claims HITRUST r2, SOC 2 Type 2 and HIPAA compliance and links a trust centre at security.metriport.com, which renders only with JavaScript (source: \u003chttps://github.com/metriport/metriport\u003e)\n\n- #10 of 12 in Best health record and wellness data APIs for AI agents: https://www.anchorterminal.com/best/health-data/index.md\n- All 63 health comparisons: https://www.anchorterminal.com/compare/health-data/index.md\n\n## Compare\n\n- [Aidbox vs Metriport Medical API](https://www.anchorterminal.com/compare/aidbox-vs-metriport.md): B 64.2 vs D 50.1\n- [Medplum vs Metriport Medical API](https://www.anchorterminal.com/compare/medplum-vs-metriport.md): B 68.7 vs D 50.1\n- [Metriport Medical API vs ROOK](https://www.anchorterminal.com/compare/metriport-vs-rook.md): D 50.1 vs C 54.9\n- [Metriport Medical API vs Terra API](https://www.anchorterminal.com/compare/metriport-vs-terra.md): D 50.1 vs B 65.9\n- [1upHealth vs Metriport Medical API](https://www.anchorterminal.com/compare/1uphealth-vs-metriport.md): D 46.8 vs D 50.1\n- [Health Gorilla vs Metriport Medical API](https://www.anchorterminal.com/compare/health-gorilla-vs-metriport.md): C 59.3 vs D 50.1\n- [Medblocks vs Metriport Medical API](https://www.anchorterminal.com/compare/medblocks-vs-metriport.md): D 52.7 vs D 50.1\n- [Metriport Medical API vs Particle Health](https://www.anchorterminal.com/compare/metriport-vs-particle-health.md): D 50.1 vs D 48.6\n- [Metriport Medical API vs Redox](https://www.anchorterminal.com/compare/metriport-vs-redox.md): D 50.1 vs C 58.3\n- [Metriport Medical API vs Zus Health](https://www.anchorterminal.com/compare/metriport-vs-zus-health.md): D 50.1 vs C 56.6\n- [Metriport Medical API vs Validic Inform](https://www.anchorterminal.com/compare/metriport-vs-validic.md): D 50.1 vs C 57.9\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on metriport.com or one of its subdomains, or the README of github.com/metriport/metriport. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"metriport\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/metriport\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/metriport.svg\" alt=\"Metriport Medical API on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Metriport Medical API on Anchor Terminal](https://www.anchorterminal.com/badges/metriport.svg)](https://www.anchorterminal.com/tools/metriport)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/metriport\"\u003eMetriport Medical API on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Metriport Medical API is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/metriport-dark.png\n- Light: https://www.anchorterminal.com/assets/share/metriport-light.png\n- Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=metriport\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Health records \u0026 wellness data", "url": "https://www.anchorterminal.com/categories/health-data" }, { "name": "Metriport Medical API", "url": "" } ], "description": "Metriport's Medical API retrieves a patient's records from US health information exchanges, pharmacies and labs, converts them to deduplicated FHIR, and returns them through a REST API with webhooks. Production use requires a covered entity with an NPI.", "facts": [ "rank #833 of 1076", "API key auth", "0 desk reviews" ], "h1": "Metriport Medical API", "image": "https://www.anchorterminal.com/assets/og/tools-metriport.png", "path": "/tools/metriport", "published": "2026-10-01", "section": "tools", "title": "Metriport Medical review (2026): pricing, alternatives and grade D", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/tools/metriport" }, "tokens": { "markdown": 6400, "slim": 1480 }, "version": 1 }